team 0.1.2 → 0.2.0

package/dist/herdr.d.ts

@@ -27,6 +27,7 @@ export declare function paneRun(pane: string, command: string, session?: string)
 export declare function agentRename(pane: string, name: string, session?: string): boolean;
 export declare function workspaceClose(workspace: string, session?: string): boolean;
 export declare function sessionStop(name: string): boolean;
+export declare function sessionDelete(name: string): boolean;
 export type PaneExec = (args: string[]) => string;
 /** Swaps the process call paneRead makes; null restores the real one. */
 export declare function setPaneExec(exec: PaneExec | null): void;

package/dist/herdr.js

@@ -171,7 +171,7 @@ export function workspaceClose(workspace, session) {
     const body = parsed(out);
     return body !== null && body.type !== 'error';
 }
-// Stops a session. Never deletes one: clearing a stopped session is the owner's command to run.
+// Stops a session, which herdr keeps listed as stopped.
 export function sessionStop(name) {
     const out = capture(['session', 'stop', name]);
     if (out === null)
@@ -179,6 +179,16 @@ export function sessionStop(name) {
     const body = parsed(out);
     return body === null || body.type !== 'error';
 }
+// Clears a stopped session — the one case `team` deletes: `down`, on the session it has itself
+// just stopped in the same run, so the next `up` starts from the beginning. `up` never deletes:
+// its refusal names this command and leaves it to the owner.
+export function sessionDelete(name) {
+    const out = capture(['session', 'delete', name]);
+    if (out === null)
+        return false;
+    const body = parsed(out);
+    return body !== null && body.type !== 'error';
+}
 const shellPaneExec = (args) => execFileSync('herdr', args, { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], timeout: 10_000 });
 let paneExec = shellPaneExec;
 /** Swaps the process call paneRead makes; null restores the real one. */

package/dist/launch/agent.js

@@ -2,9 +2,10 @@
 // pane, or the shell left after the CLI has exited, is not one: those are the panes
 // a nudge, a first message, or an exit must not be typed into.
 //
-// Null is not a live agent, so nothing is typed. `paneStillRunning` reads that same
-// null as still there — an unreadable list is not a departure, and the quota work
-// on fix/quota-live-agent keeps that reading. The two questions stay separate.
+// Null is not a live agent, so nothing is typed, and the watch's quota read asks this
+// same question: a figure is only read where the CLI was seen. `paneStillRunning`
+// reads that same null as still there — an unreadable list is not a departure — and
+// that reading is only for the departure wait in `down` and `remove`.
 export function reportedLiveAgent(foreground, processNames) {
     if (!foreground || processNames.length === 0)
         return false;

package/dist/launch/deliver.d.ts

@@ -8,5 +8,9 @@ export interface Delivery {
     now(): number;
     sleep(ms: number): Promise<void>;
 }
+/** Whether the pane's box holds exactly `text` right now: an unsent composer, no fold marker, and
+ *  rows that read back as the text. The one check the watch's nudge and the exit typing share
+ *  with delivery — false for anything not observed, never `true` on trust. */
+export declare function boxHoldsText(cli: string, text: string, screen: string | undefined): boolean;
 /** A first message is accepted only after working is observed with the composer empty again. */
 export declare function deliverRules(cli: string, text: string, seconds: number, io: Delivery): Promise<boolean | 'no-agent'>;

package/dist/launch/deliver.js

@@ -1,6 +1,146 @@
 import { reportedLiveAgent } from "./agent.js";
 import { profileFor } from "../profiles/index.js";
-import { classifyComposer, readScreen } from "../watch/screen.js";
+import { classifyComposer, readBox, readFold, readFoldMark, readScreen } from "../watch/screen.js";
+/** The rows a composer shows for `text` at `width` columns: a hard wrap, a line longer than the
+ *  width split into width-sized chunks, no word wrapping. The fold's tail and count are checked
+ *  against this model; the fixtures README names the same one. */
+function rowsOf(text, width) {
+    const rows = [];
+    for (const line of text.split('\n')) {
+        if (line.length === 0) {
+            rows.push('');
+            continue;
+        }
+        for (let at = 0; at < line.length; at += width)
+            rows.push(line.slice(at, at + width));
+    }
+    return rows;
+}
+/** Whether the folded box is exactly `text` at the width the box reports: its visible tail rows
+ *  are the text's last rows, and its hidden-row count closes the gap. Anything else is not the
+ *  typed text and gets no Enter. */
+function holdsText(text, fold) {
+    if (fold.width <= 0 || fold.rows.length === 0)
+        return false;
+    const all = rowsOf(text, fold.width);
+    if (fold.rows.length >= all.length)
+        return false;
+    if (fold.count !== all.length - fold.rows.length)
+        return false;
+    const tail = all.slice(-fold.rows.length);
+    return fold.rows.every((row, i) => row.trimEnd() === (tail[i] ?? '').trimEnd());
+}
+/** The whitespace a row break may stand for: the pane replaces it by the break, or adds the
+ *  continuation row's indentation where the text has none. */
+const BREAK = /[ \t\n\r]/;
+/** Where the text's next row starts after `pos`, or null when `row` is not the text's row there.
+ *  A row that is the text's at that very position is always read as such — that normalises
+ *  nothing. A `word` boundary additionally skips the whitespace run the pane broke at before the
+ *  row; a `hard` one reads the text's next characters as the row carries them; a composer with no
+ *  rule (`null`) reads either way, since no capture showed how that one wraps. Every character
+ *  inside a row must match the text as it is: only the row break may stand for whitespace. */
+function continues(text, pos, row, kind) {
+    if (text.startsWith(row, pos))
+        return pos + row.length;
+    if (kind === 'hard')
+        return null;
+    let at = pos;
+    while (at < text.length && BREAK.test(text[at] ?? ''))
+        at++;
+    return at > pos && text.startsWith(row, at) ? at + row.length : null;
+}
+/** Where a blank row sits in the typed text: the pane draws an empty row only for a blank line
+ *  the text itself has. The line's own content — nothing a box row shows, so only spaces and
+ *  tabs, which a pane need not paint — is consumed; an interior blank line ends at the next
+ *  newline, a blank last line ends with the text. A blank row anywhere else is not the text's
+ *  own and is refused, and a blank line the box does not show a row for is refused after the
+ *  last row (the trailing-newline check in `holdsBox`). */
+function blankLine(text, pos) {
+    if (text[pos] !== '\n')
+        return null;
+    let at = pos + 1;
+    while (at < text.length && (text[at] === ' ' || text[at] === '\t'))
+        at++;
+    return at === text.length || text[at] === '\n' ? at : null;
+}
+/** Whether the box shows exactly `text`: the first line after the prompt and every continuation
+ *  row at the box's own column — no more rows, no fewer, none changed. A continuation row that
+ *  does not start at that column is not the text's own row and the box is not trusted. Only the
+ *  whitespace a row break itself may stand for is normalised — the run a word break was made at,
+ *  or a blank line the text itself has — and inside a row every character must match, runs of
+ *  spaces included. A box that is not the text waits and is refused at the deadline, never
+ *  entered on trust. */
+function holdsBox(text, box) {
+    const pad = ' '.repeat(box.indent);
+    const rows = [];
+    for (const row of box.rows) {
+        if (row === '') {
+            rows.push('');
+            continue;
+        }
+        if (!row.startsWith(pad))
+            return false;
+        rows.push(row.slice(pad.length));
+    }
+    const kind = box.wrap?.kind ?? null;
+    const visual = [box.first, ...rows];
+    let at = 0;
+    for (let i = 0; i < visual.length; i++) {
+        const row = visual[i] ?? '';
+        if (i === 0) {
+            if (!text.startsWith(row))
+                return false;
+            at = row.length;
+            continue;
+        }
+        if (row === '') {
+            const next = blankLine(text, at);
+            if (next === null)
+                return false;
+            at = next;
+            continue;
+        }
+        const next = continues(text, at, row, kind);
+        if (next === null)
+            return false;
+        at = next;
+    }
+    // What is left after the box's last row. Trailing spaces and tabs are not observable in a
+    // box — a pane may not paint the end of a row — so they are not required to match. A newline
+    // is observable: it is the box's next row, and every row has been read above; one left over
+    // is a row the box does not show, and the box is not the typed text.
+    return /^[ \t]*$/.test(text.slice(at));
+}
+/** What the box holds right now: `ready` to submit, still rendering (`wait`), or a state that is
+ *  never the typed text (`no`). A folded box — and one showing a fold marker whatever its count —
+ *  is ready only when its tail and hidden-row count are the ones the text renders to at the width
+ *  the box reports. An ordinary box is ready only when its rows read back as exactly the text
+ *  typed; anything else waits, and a wait that outlives the deadline is a refusal, not an Enter. */
+function boxState(cli, text, screen) {
+    const kind = readScreen(cli, screen).kind;
+    const fold = readFold(cli, screen);
+    if (fold || readFoldMark(cli, screen)) {
+        if (kind !== 'unsent' && kind !== 'unknown')
+            return 'no';
+        return fold !== null && holdsText(text, fold) ? 'ready' : 'wait';
+    }
+    if (kind === 'unsent') {
+        const box = readBox(cli, screen);
+        return box !== null && holdsBox(text, box) ? 'ready' : 'wait';
+    }
+    return kind === 'idle' ? 'wait' : 'no';
+}
+/** Whether the pane's box holds exactly `text` right now: an unsent composer, no fold marker, and
+ *  rows that read back as the text. The one check the watch's nudge and the exit typing share
+ *  with delivery — false for anything not observed, never `true` on trust. */
+export function boxHoldsText(cli, text, screen) {
+    if (readFoldMark(cli, screen))
+        return false;
+    if (readScreen(cli, screen).kind !== 'unsent')
+        return false;
+    const box = readBox(cli, screen);
+    return box !== null && holdsBox(text, box);
+}
 /** A first message is accepted only after working is observed with the composer empty again. */
 export async function deliverRules(cli, text, seconds, io) {
     const names = profileFor(cli)?.processNames ?? [];
@@ -11,25 +151,28 @@ export async function deliverRules(cli, text, seconds, io) {
     if (!free() || readScreen(cli, io.screen()).kind !== 'idle' || !io.type(text))
         return false;
     const deadline = io.now() + seconds * 1000;
-    // Terminal rendering can lag send-text. Never send Enter until the pasted text is visible.
+    // Terminal rendering can lag send-text. Never press Enter until the box is verified to hold the
+    // text: an ordinary box reads `unsent`, and a box that folded the paste counts only when the
+    // tail and hidden-row count it shows are the ones the typed text renders to.
     for (;;) {
-        const kind = readScreen(cli, io.screen()).kind;
         if (!free())
             return false;
-        if (kind === 'unsent')
+        const state = boxState(cli, text, io.screen());
+        if (state === 'ready')
             break;
-        if (kind !== 'idle' || io.now() >= deadline)
+        if (state === 'no' || io.now() >= deadline)
             return false;
         const before = io.now();
         await io.sleep(100);
         if (io.now() <= before)
             return false;
     }
-    // Re-read immediately before Enter. The agent is asked again: it may have exited
-    // since the paste, and a dialog that appeared gets no key.
+    // Re-read immediately before Enter. The agent is asked again: it may have exited since the
+    // paste, and a dialog that appeared gets no key; a folded box that no longer matches the text
+    // gets none either.
     if (!live())
         return 'no-agent';
-    if (!free() || readScreen(cli, io.screen()).kind !== 'unsent' || !io.enter())
+    if (!free() || boxState(cli, text, io.screen()) !== 'ready' || !io.enter())
         return false;
     for (;;) {
         const status = io.status();

package/dist/launch/execute.d.ts

@@ -16,6 +16,8 @@ export type Host = {
     renameAgent(session: string, pane: string, name: string): boolean;
     closeWorkspace(session: string, workspace: string): boolean;
     stopSession(session: string): boolean;
+    /** Clears the session this run has just stopped. Present on `down` only: `up` never deletes. */
+    deleteSession?(session: string): boolean;
     kill(pid: number): boolean;
     /** Pane ids herdr lists an agent in, or null when the list can't be read. */
     agentPanes(session: string): string[] | null;

package/dist/launch/execute.js

@@ -29,14 +29,15 @@ export async function executePlan(steps, session, host) {
         host.say(`${seat}: ${what}\n`);
         host.log(seat, what);
     };
-    const place = (label, pane, workspace) => {
-        const have = places.get(label);
+    // The display label may be shared. The seat's name is the only key; the watch has no seat.
+    const place = (key, pane, workspace) => {
+        const have = places.get(key);
         if (have)
             return have;
         if (!pane)
             return null;
         const made = { pane, workspace };
-        places.set(label, made);
+        places.set(key, made);
         return made;
     };
     for (const step of steps) {
@@ -116,7 +117,7 @@ export async function executePlan(steps, session, host) {
                     }
                     break;
                 }
-                places.set(op.label, made);
+                places.set(op.seat ?? op.label, made);
                 if (op.seat) {
                     host.record(op.seat, { stage: 'launched', pane: made.pane, workspace: made.workspace });
                     host.running(op.seat);
@@ -132,7 +133,7 @@ export async function executePlan(steps, session, host) {
                     finish(op.seat, why);
                     break;
                 }
-                const here = place(op.label, op.pane);
+                const here = place(op.seat, op.pane);
                 if (!here || !host.paneRun(session, here.pane, op.command)) {
                     dropped.add(op.seat);
                     finish(op.seat, 'its launch command did not run; left at launched');
@@ -144,7 +145,7 @@ export async function executePlan(steps, session, host) {
             case 'idle': {
                 if (op.notice)
                     host.say(`${op.seat}: ${op.notice}\n`);
-                const here = place(op.label, op.pane, op.workspace);
+                const here = place(op.seat, op.pane, op.workspace);
                 if (!here) {
                     dropped.add(op.seat);
                     finish(op.seat, 'has no pane to read; left at launched');
@@ -167,7 +168,7 @@ export async function executePlan(steps, session, host) {
                 }
                 if (outcome === 'idle')
                     break;
-                const workspace = here.workspace ?? places.get(op.label)?.workspace;
+                const workspace = here.workspace ?? places.get(op.seat)?.workspace;
                 if (outcome === 'permission' || outcome === 'trust' || outcome === 'question') {
                     // A trust question is closed with no key and no text. The same for a permission or a question.
                     if (workspace)
@@ -185,7 +186,7 @@ export async function executePlan(steps, session, host) {
                 break;
             }
             case 'rename': {
-                const here = place(op.label, op.pane);
+                const here = place(op.seat, op.pane);
                 if (!here) {
                     dropped.add(op.seat);
                     finish(op.seat, 'has no pane to name; left at launched');
@@ -207,7 +208,7 @@ export async function executePlan(steps, session, host) {
             case 'deliver': {
                 if (op.notice)
                     host.say(`${op.seat}: ${op.notice}\n`);
-                const here = place(op.label, op.pane);
+                const here = place(op.seat, op.pane);
                 const delivered = here ? await host.deliverRules?.(session, here.pane, op.cli, op.rules, op.seconds) : false;
                 if (delivered === 'no-agent') {
                     dropped.add(op.seat);
@@ -283,10 +284,19 @@ export async function executePlan(steps, session, host) {
                     host.say(`session ${op.session}: not stopped, something was left in it\n`);
                     break;
                 }
-                if (!host.stopSession(op.session))
+                if (!host.stopSession(op.session)) {
                     host.say(`session ${op.session}: it did not stop\n`);
-                else
+                    break;
+                }
+                // Without a `deleteSession` the stop is the whole step. `down` goes one further and clears
+                // the session it has itself just stopped; a clear that does not happen names the command.
+                if (host.deleteSession === undefined)
                     host.say(`session ${op.session}: stopped\n`);
+                else if (host.deleteSession(op.session))
+                    host.say(`session ${op.session}: stopped and cleared\n`);
+                else {
+                    host.say(`session ${op.session}: stopped; it did not clear, run \`herdr session delete ${op.session}\`\n`);
+                }
                 break;
             }
             default:

package/dist/launch/plan.js

@@ -46,7 +46,7 @@ export function upPlan(input) {
             steps.push({ kind: 'skip', text: `${seat.name}: already ready; left as it is` });
             continue;
         }
-        const pane = seat.pane ?? paneOf(seat.label);
+        const pane = seat.pane ?? paneOf(seat.name);
         const cwd = join(input.root, seat.cwd);
         const fresh = seat.stage === undefined || !seat.pane;
         // The same condition as the launch step below. A seat already running keeps
@@ -202,6 +202,15 @@ export function downPlan(input) {
                 });
                 continue;
             }
+            if (seat.cli === 'unknown') {
+                steps.push({
+                    kind: 'skip',
+                    text: `${seat.name}: the state doesn't say which CLI it runs, so it can't be asked to exit; ` +
+                        'left running (`team down --abandon` closes it without typing)',
+                });
+                left++;
+                continue;
+            }
             steps.push({
                 kind: 'skip',
                 text: `${seat.name}: no launch profile for \`${seat.cli}\` in this version; left running`,
@@ -259,7 +268,12 @@ export function downPlan(input) {
         });
     }
     else {
-        steps.push({ kind: 'run', argv: ['herdr', 'session', 'stop', session], do: { do: 'stop', session } });
+        steps.push({
+            kind: 'run',
+            argv: ['herdr', 'session', 'stop', session],
+            note: 'stopped, then cleared: the session this run stopped, so a later `up` starts from the beginning',
+            do: { do: 'stop', session },
+        });
     }
     return steps;
 }

package/dist/profiles/antigravity.yaml

@@ -68,8 +68,18 @@ screen:
   composer:
     mode: two-rules-footer-below
     ignore_case: true
-    prompt: '^\s*>\s*'
-    rule: '^\s*[─━]{8,}\s*$'
+    # The input row is the box's first row under its opening rule, carrying the prompt at the
+    # pane's first column — unsent.txt draws `> Rules...` there, content at the second — and a
+    # prompt glyph on a continuation row is content, never the input row. The reader anchors
+    # this pattern to the captured column.
+    prompt: '^>\s*'
+    # Both rules are unbroken runs of ─ from the pane's first column (unsent.txt draws them at
+    # rows 7 and 12). A rule-looking row the box holds is drawn at the content column and is
+    # content, never the frame.
+    rule: '^[─━]{8,}\s*$'
+    # A long paste folds: the row reads `↑ N more lines` (with the prompt glyph on the
+    # input row's own marker), the rows below it are the tail. Capture 1 is N.
+    fold: '^\s*(?:>\s*)?↑\s*([0-9]+)\s+more lines\s*$'
     footers:
       - '\? for shortcuts'
       - 'Gemini\s+[0-9]'

package/dist/profiles/claude-code.yaml

@@ -1,6 +1,6 @@
-# Claude Code's screen. The questions are written out in both cases: the old
-# classifier ignored case on those two lines and not on the "1. Yes" choice, and
-# ignore_case would apply to the whole rule.
+# Claude Code's screen. The trust question carries ignore_case on its own pattern:
+# the old classifier ignored case on those lines and not on the "1. Yes" choice,
+# and a rule-wide or stage-wide flag would have reached the choice too.
 format: 1
 cli: claude-code
 binary: claude
@@ -39,8 +39,12 @@ status_model:
 screen:
   trust:
     - all:
-        - '(?:[Dd][Oo] [Yy][Oo][Uu] [Tt][Rr][Uu][Ss][Tt] (?:[Tt][Hh][Ii][Ss]|[Tt][Hh][Ee]) [Ff][Oo][Ll][Dd][Ee][Rr]\?|[Oo][Nn][Ee] [Yy][Oo][Uu] [Tt][Rr][Uu][Ss][Tt]\?)'
+        - match: '(?:Do you trust (?:this|the) folder\?|One you trust\?)'
+          ignore_case: true
         - '^\s*[❯›>]?\s*1\.\s+Yes\b'
+    - all:
+        - '^\s*[❯›>]?\s*Yes, I trust this folder\b'
+      footer: 'Enter to confirm · Esc to cancel'
   # A quoted question above the composer's rule is not a dialog. The footer is the
   # captured last line and needs the question. A Yes/No choice below the last rule
   # is the other shape; the mark is optional, as on an unmarked "2. No".
@@ -88,8 +92,19 @@ screen:
         - '^[^\S\n]*[✢✳✶✻✼✽][^\n]*…\s*\(\s*\d'
   composer:
     mode: box-to-rule
-    prompt: '^\s*[❯›>]'
-    rule: '^\s*[─━]{8,}'
+    # The prompt sits at the pane's first column, as unsent-typed-ansi.txt draws `❯ Fix the`;
+    # the pane draws continuation rows at the content column — two spaces — so a prompt glyph
+    # on one of those is content, never the input row. The reader takes the box's first row
+    # under its opening rule and anchors this pattern to the captured column: a row the box
+    # holds can never be mistaken for the input.
+    prompt: '^[❯›>]'
+    # The box's two rules, as unsent-typed-ansi.txt draws them: one unbroken run of ─ from the
+    # pane's first column, the closing rule the window's last rule row. A rule-looking row the
+    # box holds is drawn at the content column and is content, never the frame.
+    rule: '^[─━]{8,}$'
+    footers:
+      - '^\s{2,}.*·.*(?:Opus|Sonnet|Haiku|Fable)\s+[0-9]+.*$'
+      - '^\s{2,}(?:⏵⏵\s+)?bypass permissions\b.*$'
     # Claude Code greys every suggestion it shows — "Try …", "Resume briefly.", any other —
     # with faint styling, while typed text carries none. The list below stays the fallback
     # for a source without styling.

package/dist/profiles/codex.yaml

@@ -44,6 +44,9 @@ status_model:
     model: 'GPT {2:title}'
     version: '{1}'
   # A later footer that is not one of those four names is unread, as the old id map was.
+  # The `{1}` names a group this pattern does not have, on purpose: a template that cannot
+  # fill reads the line as naming no model. There is no plainer spelling — an empty string
+  # is refused and a literal would read as a found model, not as unread.
   - match: '^\s+GPT-[0-9][\w.-]*\s[^·]*·'
     model: '{1}'
     version: '{1}'
@@ -71,7 +74,17 @@ screen:
   composer:
     mode: status-last
     status_line: '^\s+GPT-[0-9][\w.-]*\s+[^·]*·'
-    prompt: '^\s*›(?:\s|$)'
+    # The input row carries the prompt at the pane's first column — unsent.txt draws `› Rules.`
+    # there, content on the rows below at the second, and exit-typed.txt keeps the old
+    # transcript and menu rows above it — and a prompt glyph on a content row is never the
+    # input row. The read scans up from the status line and anchors this pattern to the
+    # captured column.
+    prompt: '^›(?:\s|$)'
     placeholders:
       - equals: ''
       - equals: Ask Codex to do anything
+    # unsent.txt and exit-typed.txt show one empty row under the text, between it and the
+    # status line: the drop the pane draws of its own, inside the box's frame. The box read
+    # strips up to one trailing empty row as that frame; a row beyond it is one the typed
+    # text does not have.
+    frame_rows: 1

package/dist/profiles/cursor.yaml

@@ -48,21 +48,61 @@ screen:
           - '^\s*→'
           - '^\s+Grok\s+[0-9]'
   working:
-    # The running turn is the braille spinner, or the prompt line ending in
-    # "ctrl+c to stop". Idle and rules-accepted captures do not paint that suffix.
-    # The same words quoted in the transcript are not a turn.
+    # The running turn is the braille spinner (whatever verb it paints), the
+    # prompt line ending in "ctrl+c to stop", or the follow-up queue: the box's
+    # `enter …` hint row with, below it, the composer's own row — empty, or its
+    # placeholder. The order is the frame's: what follows the hint row may be
+    # chrome or that unpainted composer row and nothing else, so a typed row
+    # under the box falls to the composer read and says unsent. A transcript
+    # that quotes the box paints its prose lines there, so the queue rule reads
+    # them as content and leaves the screen alone. Idle and rules-accepted
+    # captures paint none of these.
     - any:
         - '^\s*→.*\s{2,}ctrl\+c to stop\s*$'
-        - '^\s*[⠀-⣿]+\s+(Working|Thinking)\b'
+        - '^\s*[⠀-⣿]+\s+\S'
+    - all:
+        - '^\s*│\s*enter (?:steer|interrupt and send) · ↑ select/edit · esc cancel\s*│\s*$'
+        - '^\s*→\s*(?:Add a follow-up|Plan, search, build anything)?\s*$'
+      none_after:
+        anchor: '^\s*│\s*enter (?:steer|interrupt and send) · ↑ select/edit · esc cancel\s*│\s*$'
+        patterns:
+          - match: '^\s*\S'
+            except:
+              - '^\s*[│┌└─┐┘├┤]'
+              - '^\s*[⠀-⣿]'
+              - '^\s*Tip:'
+              - '^\s*→\s*(?:Add a follow-up|Plan, search, build anything)?\s*$'
+              - '^\s+Grok\s'
+              - '^\s*<workspace>'
+              - '^\s*~/'
+              - '^\s*❯'
   composer:
     mode: status-then-one
     status_line: '^\s+Grok\s+[0-9]'
-    prompt: '^\s*→'
+    # The input row carries the prompt at the pane's second column — unsent.txt and
+    # follow-up-queue-typed.txt draw `  → Plan, search, build anything` there, continuations at
+    # the fourth — and a prompt glyph on a content or popup row is never the input row. The
+    # read scans up from the status line and anchors this pattern to the captured column.
+    prompt: '^ {2}→'
     strip_suffix: '\s*ctrl\+c to stop\s*$'
     placeholders:
       - equals: ''
       - equals: Plan, search, build anything
       - equals: Add a follow-up
+    # A line wider than the pane's content column continues on the next row at the text
+    # column, broken at a space: unsent.txt is its sentence word-wrapped this way on a
+    # 51-column pane, and the box is compared with the typed text before any Enter. Only
+    # the whitespace the row break itself stands for is normalised — the run the break was
+    # made at, or a blank line the text itself has; inside a row, every character must
+    # match, runs of spaces included.
+    wrap:
+      continuation: text-column
+      kind: word
+    # unsent.txt and follow-up-queue-typed.txt show two empty rows under the text, between
+    # it and the status line: the drop the pane draws of its own, inside the box's frame.
+    # The box read strips up to two trailing empty rows as that frame; a row beyond them is
+    # one the typed text does not have.
+    frame_rows: 2
     fallback:
       - all:
           - match: '^\s*→\s+\S'

package/dist/profiles/overrides.d.ts

@@ -0,0 +1,67 @@
+import type { QuotaPattern } from './quota.ts';
+import type { ScreenData, Stage } from '../watch/screen-data.ts';
+import { type Screen } from '../watch/screen.ts';
+export declare const DIALOG_STAGES: readonly ["unknown", "trust", "permission", "question"];
+export type DialogStage = (typeof DIALOG_STAGES)[number];
+export type ProfileOverride = {
+    cli: string;
+    screen: Partial<Record<DialogStage, Stage>>;
+    quota: QuotaPattern[];
+};
+export type OverrideProblem = {
+    line: number;
+    message: string;
+};
+export type OverrideParse = {
+    ok: true;
+    profiles: ProfileOverride[];
+} | {
+    ok: false;
+    errors: OverrideProblem[];
+};
+/** `<store>/overrides.yaml`, the same folder as the approval for this root. */
+export declare function overridesPath(project: string, root: string, home: string): string;
+/** The file's added patterns, or the line that refuses it. One error, the first. */
+export declare function parseOverrides(text: string): OverrideParse;
+/**
+ * Shipped rules stay first, and the added ones follow. The composer and the
+ * chrome are the shipped profile's own objects, so an override cannot retune
+ * them by merging.
+ */
+export declare function mergeScreen(base: ScreenData, added: ProfileOverride): ScreenData;
+/**
+ * An added pattern may move a reading toward a dialog. It may not make a screen
+ * idle or unsent when the shipped profile does not, and it may not stop a
+ * shipped permission, trust or question pattern from matching.
+ */
+export declare function guardReading(shipped: Screen, merged: Screen): Screen;
+/** The shipped reading, then the same window with this profile's added patterns, guarded. */
+export declare function classifyWith(cli: string, screen: string | undefined, profiles: readonly ProfileOverride[]): Screen;
+/** Shipped quota patterns, then the override's. The shipped ones are never dropped. */
+export declare function quotaWith(cli: string, profiles: readonly ProfileOverride[]): readonly QuotaPattern[];
+/** What `approve` records when the override file itself is the change. */
+export declare const OVERRIDE_CHANGED = "`overrides` changed";
+/** A stored copy that does not parse. The shipped profiles stay in force. */
+export declare const OVERRIDE_UNREADABLE = "the approved overrides can't be read";
+export type OverrideForce = {
+    /** The approved patterns. Empty when none were approved, or the copy cannot be read. */
+    profiles: ProfileOverride[];
+    /** Drift from the approved copy. Empty when the file is the approved one, or there is none. */
+    differences: string[];
+    /** The live file, when it cannot be read or parsed. Already carrying the path and the line. */
+    problems: string[];
+};
+/** The override file's text, and why it was refused. A missing file is an empty text and no problem. */
+export declare function overrideFile(project: string, root: string, home: string): {
+    path: string;
+    text: string | null;
+    problems: string[];
+};
+/**
+ * The patterns in force for this project. Keyed on the project root, the same
+ * store as the team-file approval: another checkout of the same name has its
+ * own. No file, or a stored copy that cannot be read, leaves the shipped profiles.
+ * The live file is used only when it is the text `approve` recorded.
+ */
+export declare function overridesInForce(project: string, root: string, home: string): OverrideForce;
+export declare function overrideProblem(path: string, problem: OverrideProblem): string;